Security Best Practices

When deploying and using Enforcer-CCA, we recommend adhering to the following security best practices to ensure your own environment remains bulletproof.

Least Privilege Principle

Always use least privilege when creating IAM roles for Enforcer-CCA integrations. Only grant the specific permissions required for the policies you intend to enforce.

API Key Management

• Rotate your API keys every 90 days.
• Never hardcode API keys in your CI/CD scripts; use secure secret managers (e.g., AWS Secrets Manager, HashiCorp Vault, GitHub Secrets).

Remediation Approval Workflows

Remediation in Enforcer-CCA is always gated: fixes execute only when the platform is explicitly set to remediate mode and a human approves the specific action. Keep approval rights restricted to a small set of reviewers, and use the platform's role-based access control to separate who can view findings from who can approve fixes.

For more detailed technical guides, please refer to the specific cloud provider integration manuals.